North Korea's Lazarus hackers now encrypt their tools against quantum computers

On a page hosted by GitHub, a job candidate presents themselves as a "senior network equipment developer." Their résumé comes with a photo. According to Kaspersky, the face was very likely generated by AI, and the candidate does not exist. The page served as bait for an espionage operation that the vendor attributes to Lazarus, a hacking group linked to North Korea.

On October 21, Kaspersky's research team (GReAT) published its analysis of the campaign, dubbed FlashHole, on its Securelist blog and presented it at the Security Analyst Summit in Bali. Active since at least July 2025, the campaign has hit at least three South Korean companies: a software vendor, a construction company and a maker of wired communication equipment. Kaspersky expects the number of victims to be "considerably" higher. One detail stands out: to retrieve its malicious payloads, one of the group's tools uses ML-KEM. This is the post-quantum encryption algorithm standardized in August 2024 by NIST, the U.S. National Institute of Standards and Technology (standard FIPS 203).

A fake résumé, then hijacked banking security software

Targets received personalized emails that led to fake résumés or portfolios published on GitHub Pages. According to Kaspersky, AI was "very likely" used to create them. The photo contains no metadata and its texture looks unnatural. The portfolio, for its part, strings together meaningless details and randomly chosen companies.

The attack then goes through INISAFE CrossWeb EX, security software required for online financial services in South Korea. Kaspersky does not know how it was hijacked. According to the vendor, a possible vulnerability in this software may have served as the entry point. Kaspersky points to a report by the Korean specialist AhnLab, which confirms that vulnerabilities were exploited in Korean financial security software, without naming them. A legitimate Windows program is then launched and injected with malicious code. Several tools take over: two new ones, TouchHub and ClientHub, then LPEClient, an older Lazarus tool, and finally Cubridge, a backdoor that manages files, runs commands and takes screenshots. Almost everything runs in memory, leaving no file on disk.

Why guard against a quantum computer that doesn't exist yet?

LPEClient is the tool that uses ML-KEM. According to Securelist, the attackers' server sends it four ML-KEM-1024 public keys, the strongest variant of the algorithm. The software derives four shared secrets from them and sends the necessary data back to the server, itself encrypted with an algorithm from the GOST family. These secrets are then used to decrypt the next payload, the Cubridge backdoor, which is loaded directly into memory.

"The use of post-quantum cryptography shows that the group intends to hide its subsequent payloads," Kaspersky writes. The benefit is real, but it should be kept in perspective. Against an analyst today, well-designed classical encryption was already enough. ML-KEM adds a guarantee: traffic recorded now cannot be decrypted later, even by a future quantum computer. Kaspersky points out that the group seems to have adopted this cryptography faster than many legitimate security products, and traces its use back to at least September 2024.

What defenders can take from it

Nothing here weakens corporate encryption. ML-KEM is a public tool, available in open-source libraries, and attackers use it like everyone else. Detection therefore does not rely on decrypting the traffic, but on behavior. Kaspersky recommends in particular:

• training staff to spot targeted phishing and report suspicious messages;
• applying patches quickly and disabling unnecessary components;
• limiting user privileges;
• monitoring connections to the cloud services that attackers hijack to control their tools, such as GitHub or Dropbox.

Kaspersky reports no victims outside South Korea, a country already shaken this month by the hacking of several of its banks. One question remains open: how many other malware families have already made this choice without being detected? Defenders, meanwhile, are still at the migration stage, as our update on post-quantum cryptography in October 2026 shows.